Looks great, but... how can one trust it with credentials/communication? (nothing against the developer, more the principle of the thing)